The Great Cannon has been deployed again • Hacker News Board

Re: The Great Cannon has been deployed again

#441

Post by st1ck » Sat, Dec 07, 2019, 12:50 PM UTC

chewbacha wrote: post #161

MR4D wrote: post #142

Earlier quoted context omitted.

War seems to progress as follows: 0 - Peace 1 - Trade War 2 - Financial War 3 - Electronic War 4 - Shooting War Note that 1 & 2 are different types of Economic war, and could be grouped together. The steps occur in order, but steps can be skipped. From a US-centric point of view, North Korea and Iran seem to be at #3. China & Russia are at a limited version of #2. Chinese/HK seem to be at #3 with each other.Given how…

I don't know who to attribute this to but I've heard a saying: "Countries that trade with each other don't make war with each other." As we isolate countries and disrupt trade we definitely are increasing the risk of conflict.

Doesn't seem to work between Russia and Georgia, Moldova or Ukraine.

Re: The Great Cannon has been deployed again

#442

Post by jeroenhd » Sat, Dec 07, 2019, 1:42 PM UTC

geofft wrote: post #400

jMyles wrote: post #263

Earlier quoted context omitted.

> Unfortunately there's a giant category of devices that can't serve TLS. Like pretty much every consumer router in existence that you connect to through a webpage. Come on now. Of course those devices can use TLS - they just can't do so in the capricious constraints imposed by the system of "certificate authorities". It's not a fundamental limitation of the technology. If we were using something like noise protocol,…

Why do they have to use self-signed certs? Ship the device with a valid cert for $last_three_octets_of_mac_address.$vendor.com to the device, and print it clearly on the setup instructions. Typing in something like d63d15.ui.com isn't onerous. The CA/Browser Forum allows certs up to 27 months - do routers sit on store shelves for 27 months before being configured? Do they even sit for 12 months? (Once they're online,…

That would require significant effort for the vendor to set up and most internet devices such as routers are an absolutely minimal cost device. Literally every cent counts in production and vendors rather remove some features than shell out the 2 cents extra to add another 64mb of storage.

Furthermore, this would require either not being able to change the IP for your device (bad) or sending information about the layout of your network to the vendor (I wouldn't trust them with that info).

Very few people care about this and the effort of maintaining a custom DNS and a CA certificate system (which, by the way, would need to be subjected to rigorous security testing) just isn't worth it.

Lastly, what's the point? Adding a little padlock isn't worth it if anyone can get a certificate for the router ip anyway. How do you ensure that the router connecting to your IP really has the mac address it claims? It only takes one person to get root on their router to invalidate the entire security system and given how somehow router vendors are still shipping command injection vulnerabilities, I wouldn't assume that they can prevent that as much as they'd like.

What I want is the option to give a router my own security certificate instead of the self signed one. Let me use my own CA or let me mess around with letsencrypt, split-horizon DNS and Selenium scripts if that's what I need. Consumers don't care about TLS on their router and this would be the cheapest option to solve it for prosumers.

Re: The Great Cannon has been deployed again

#443

Post by ethbro » Sat, Dec 07, 2019, 2:06 PM UTC

dmix wrote: post #203

ethbro wrote: post #67

Earlier quoted context omitted.

> conduct a massive DDoS attack That's not an accurate summary of what they're doing. They're intermittently serving poisoned js in place of known analytics scripts. Which changes the potential "who" a bit.

Either someone hacked the root Baidu servers, Baidu is involved, or the network requests are being manipulated by Chinese controlled entities. There’s a high probability this is state run. There’s probably tons of offensive cyber teams in China and these are hitting sites like Greatfire.org which documents Chinese censorship (which was also why Github was hit if I’m not mistaken). It’s not surprising that the organs…

Absolutely. Or potentially some cert wonkery.

I haven't looked at this closely enough to know how the script's chaining works, or if China retains MitM capability across TLS.

Regardless, it's nice to be reasonably accurate when we're tossing around claims.

Re: The Great Cannon has been deployed again

#444

Post by colejohnson66 » Sat, Dec 07, 2019, 2:41 PM UTC

D-Coder wrote: post #390

LeftHandPath wrote: post #313

Earlier quoted context omitted.

I recently (4 or 5 months ago) joined an online community of aircraft owners and pilots that is primarily focused around a single brand of aircraft (although it's not an official site of, property of, that brand nor is it endorsed by that brand). When I signed up, they emailed me to welcome me to the site (they actually require manual authorization of users by an admin, which is... refreshing, but uncommon). The emai…

"How secure do you need your browsing to be?" Perhaps explain to them that many people (unwisely) reuse passwords for many sites... possibly including their banking.

To which they respond, in essence, “their fault”

Re: The Great Cannon has been deployed again

#445

Post by [deleted] » Sat, Dec 07, 2019, 2:49 PM UTC

nullc wrote: post #174

The web needs to start moving towards a strong same-origin policy for all embedded content-- require sites to proxy requests if they want third party content. The first step could be sending CORS preflight, then requiring it, then just not allowing cross origin to different domains (but allow sub-/sibling- domains).

[deleted]

Re: The Great Cannon has been deployed again

#446

Post by geofft » Sat, Dec 07, 2019, 3:10 PM UTC

londons_explore wrote: post #434

geofft wrote: post #400

Earlier quoted context omitted.

Why do they have to use self-signed certs? Ship the device with a valid cert for $last_three_octets_of_mac_address.$vendor.com to the device, and print it clearly on the setup instructions. Typing in something like d63d15.ui.com isn't onerous. The CA/Browser Forum allows certs up to 27 months - do routers sit on store shelves for 27 months before being configured? Do they even sit for 12 months? (Once they're online,…

No need for even that. TLS should have an extension which says "I don't know how to verify my identity, but send this data to vendor.com and then they'll verify my identity". Vendor.com can then look at the opaque blob forwarded from their hardware and decide if they want to deligate trust to it.

That doesn't quite work, because the premise of accessing a router setup page is that your internet connection doesn't work yet. So your router has to be able to prove its identity to the client entirely offline.

(You cannot special-case "This server is untraceable", else a repressive government could blackhole that server and trigger the relaxed validation rules.)

Re: The Great Cannon has been deployed again

#447

Post by paulddraper » Sat, Dec 07, 2019, 3:12 PM UTC

geofft wrote: post #405

paulddraper wrote: post #403

Earlier quoted context omitted.

> they want to run a restricted subset of what the web designer might imagine For the kinds of places that AMP is used, I would suspect so. > Also, users did vote with their feet against downloading EXEs from the internet So....this CAN happen??? > users would gladly accept even more restrictions on the execution platform. The recent popularity of clipboard permissions, geolocation permissions, notification permissio…

> The recent popularity of clipboard permissions, geolocation permissions, notification permissions, etc. would suggest otherwise. What popularity? Do you have data that users tend to click "yes" on such permission prompts? > What makes you so sure that web users care so much about the uptime of lihkg.com ? I'm not sure I understand what you're asking or what you're responding to.

> I'm not sure I understand what you're asking or what you're responding to.

lihkg.com being down is the negative consequence of this code running, right?

Re: The Great Cannon has been deployed again

#448

Post by unethical_ban » Sat, Dec 07, 2019, 4:13 PM UTC

mgerdts wrote: post #372

unethical_ban wrote: post #362

Earlier quoted context omitted.

I'll top that. I used TABCPermit.com to get licensed to serve alcohol in Texas. Their signup form says "no special characters in password". I used one anyway, putting in "password$1" for example. It accepted it, and I worked on the test. Next day, I can't login. I use the "forgot password" link. They send me and email, and it has my password in it! Bad, right? That isn't all. My password, they said, was "password1".…

Are you sure your password has a $ in it? What makes you think that they don't strip the $ when you set and enter your password? If it seemed like they were doing a hash then compare, I would wonder if they are using the legacy unix crypt that truncates passwords at 8 characters.

I know when I registered and typed twice that my password had "$" in it. And they mailed me back my password without it. Finally, it wasn't just a truncate because there were characters after the position where "$" should be.

And if they did strip it out, that is bad. That's the point.

Re: The Great Cannon has been deployed again

#449

Post by prirun » Sat, Dec 07, 2019, 4:13 PM UTC

Zanneth wrote: post #421

taneq wrote: post #412

Earlier quoted context omitted.

But a “website” isn’t an HTML page any more. It’s a network-deployed application. Most people want to run these applications.

To reiterate threeseed’s point: the user wants the website to work well and work efficiently. They don’t care if it’s HTML or an interactive app. In a lot of cases, the web works better when pages are served as plain static HTML.

Websites also work better, IMO, when every page doesn't use remote resources on 10 different domain names hosted by 3rd-party vendors. This is one of the reasons I use Vultr instead of Digital Ocean: instead of locally hosting their own JS pages, DO uses 3rd-party services. (Maybe they don't have a choice if the 3rd party requires it.) Whereas with Vultr, I only had to enable one or 2 domain names and the whole site worked. It's a much better experience for the user IMO.

Re: The Great Cannon has been deployed again

#450

Post by throw5543265 » Sat, Dec 07, 2019, 5:23 PM UTC

emmelaich wrote: post #128

pkilgore wrote: post #7

So if the cannon is created using the great firewall, how does the Chinese government establish any sort of plausible argument that this isn't state-sponsored activity? Do they just not care? Some day soon a war will not be started with an assassins bullet but with a tool like this. I wonder when we start looking at them the same way?

Pretty sure they don't care. They're also directing lasers at helicopter pilots, which is much closer to a actual war than mere bits. https://www.abc.net.au/news/2019-12-06/chinese-fishing-vesse...

The protesters in Hong Kong were also directing lasers at police and police helicopters. I don’t think that should be considered an “act of war.”